CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

OPENSUSE-SU-2019:1813-1 Security update for MozillaThunderbird

This update for MozillaThunderbird version 60.8 fixes the following issues: Security issues fixed: - CVE-2019-9811: Sandbox escape via installation of malicious language pack bsc1140868. - CVE-2019-11711: Script injection within domain through inner window reuse bsc1140868. - CVE-2019-11712:...

SUSE-SU-2019:1960-1 Security update for MozillaThunderbird

This update for MozillaThunderbird version 60.8 fixes the following issues: Security issues fixed: - CVE-2019-9811: Sandbox escape via installation of malicious language pack bsc1140868. - CVE-2019-11711: Script injection within domain through inner window reuse bsc1140868. - CVE-2019-11712:...

SUSE-SU-2019:1910-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: This update contains the Intel QSR 2019.1 Microcode release bsc1111331 Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBD...

PT-2019-4893 · Xen +1 · Xen +1

Name of the Vulnerable Software and Affected Versions: Xen versions prior to 4.12 Description: The issue is related to an incompatibility between Process Context Identifiers PCID and TLB flushes, allowing x86 PV guest OS users to cause a denial of service or gain privileges. This is due to...

Over 1,300 Android Apps Caught Collecting Data Even If You Deny Permissions

Smartphones are a goldmine of sensitive data, and modern apps work as diggers that continuously collect every possible information from your devices. The security model of modern mobile operating systems, like Android and iOS, is primarily based on permissions that explicitly define which sensiti...

Over 1,300 Android Apps Caught Collecting Data Even If You Deny Permissions

Smartphones are a goldmine of sensitive data, and modern apps work as diggers that continuously collect every possible information from your devices. The security model of modern mobile operating systems, like Android and iOS, is primarily based on permissions that explicitly define which sensiti...

CVE-2019-6635

creationtimestamp| type| source ---|---|--- 2019-07-04 18:00:03+00:00| seen| https://t.me/cveNotify/186 2019-07-05 17:00:16+00:00| seen| https://t.me/cveNotify/242...

CVE-2019-13074

creationtimestamp| type| source ---|---|--- 2019-07-01 07:17:01+00:00| seen| Telegram/xADcJHvbl80L1aSpPUDb8qsDyOlCjAaYyJv5UKHSmc4u5lc 2020-06-01 02:07:41+00:00| seen| Telegram/RYuO9rnZyZatuBLmi4stN6fr4cvIa3LCbuSc0quitWP1aoWi...

The vulnerability of the jsm_probe_one handler implementation in Linux kernels allows a hacker to trigger a service failure.

The vulnerability in the implementation of the jsmprobeone function in the drivers/tty/serial/jsm/jsm.ko kernel of the Linux operating system is caused by a memory leak. Exploiting this vulnerability can allow an attacker to cause a system failure by connecting a Digi International Neo and Classi...

The vulnerability of the monitoring panel for Cisco Unified Intelligence Center’s reporting functions allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the monitoring panel for creating Cisco Unified Intelligence Center reports is related to improper control of resource identifiers. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information by usin...

The vulnerability of the eLearning Server 4G system regarding access control allows a hacker to gain access and modify the user’s portfolio.

The vulnerability of the eLearning Server 4G system management and development framework is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access—and modify—user portfolios by altering the value of the user identifier in HTTP request...

UBUNTU-CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

UBUNTU-CVE-2019-9187

ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs...

SUSE-SU-2019:1423-1 Security update for libvirt

This update for libvirt fixes the following issues: Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBDS - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling MFBDS -...

Hunting COM Objects

COM objects have recently been used by penetration testers, Red Teams, and malicious actors to perform lateral movement. COM objects were studied by several other researchers in the past, including Matt Nelson enigma0x3, who published a blog post about it in 2017. Some of these COM objects were...

CVE-2019-10049

It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code that is executed in the context of the victim use...

Design/Logic Flaw

It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code that is executed in the context of the victim use...

The vulnerability of SCALANCE programmable logic controllers’ microprogramming software is related to insufficient protection of the website structure, allowing attackers to obtain the protected web connection identifiers.

The vulnerability of the microprogrammed programmable logic controller SCALANCE is related to insufficient protection of the website structure. Exploiting this vulnerability could allow an attacker to disclose the protected web connection identifiers from cookie files through a specially crafted...

DEBIAN-CVE-2019-10910

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection...